Courseiva

Splunk Core Certified User SPLK-1002 (SPLK-1002) — Questions 1–75

510 questions total · 7pages · All types, answers revealed

Take a mock examExam hub

Page 1 of 7

Page 2
1
MCQhard

Refer to the exhibit. The timechart returns only partial results for some sourcetypes, and there are gaps in the timeline. Which is the most likely reason?

A.The timechart span=1h conflicts with the tstats span
B.The tstats command only uses summary data, which may not cover all time ranges
C.The sourcetype field is not summarized
D.The where clause is invalid
AnswerB

summariesonly=t restricts tstats to precomputed summaries; if the summary is incomplete, results will have gaps.

Why this answer

The `tstats` command in Splunk operates on indexed-time summary data stored in the tsidx files, not on raw events. This summary data is generated during indexing based on the data model acceleration or summary indexing configuration, and it may not cover all time ranges if the acceleration has not been built for those periods or if the data model is not fully accelerated. As a result, `tstats` can return partial results and gaps in the timeline, especially when the time range extends beyond the accelerated data coverage.

Exam trap

Splunk often tests the misconception that `tstats` behaves like `search` or `stats` and can access all raw events, but the trap here is that candidates overlook the fact that `tstats` is limited to summary data and may not cover all time ranges if acceleration is incomplete or not configured.

How to eliminate wrong answers

Option A is wrong because the `timechart span=1h` does not conflict with the `tstats span`; `tstats` does not have a `span` argument — it uses the `_time` field and the `timechart` command applies its own binning after `tstats` returns results, so no conflict exists. Option C is wrong because the `sourcetype` field is a default indexed field that is always summarized in the tsidx files, so it is available for `tstats` to use. Option D is wrong because the `where` clause in the exhibit is syntactically valid (e.g., `where sourcetype=access_*` is a valid pattern match), and there is no indication of an invalid syntax or runtime error.

Full explanation →
2
MCQhard

A company uses Splunk to monitor web server logs. They have a lookup table that maps IP addresses to geographic locations (city, country). The lookup is defined as a CSV file with fields: ip, city, country. The lookup definition is named 'geo'. The team wants to automatically add city and country to every web event at index time, so that all future searches have this enrichment without adding the lookup command. The team tries to set up an automatic lookup in props.conf for the sourcetype 'web_access', but the city and country fields still do not appear in the events. They verify that the lookup file exists and that the lookup definition works when used manually with the lookup command. What is the most likely cause of the automatic lookup not working?

A.Index-time lookups are not supported; enrichment can only be done at search time
B.The lookup file must be in KV Store format for index-time lookups
C.The lookup must be invoked with the 'lookup' command in the search to populate the fields
D.The automatic lookup definition in props.conf is not correctly configured for the intended sourcetype
AnswerD

If the props.conf stanza does not match the sourcetype, the lookup will not be applied.

Why this answer

Option D is correct because the automatic lookup definition in props.conf must be correctly configured for the intended sourcetype. The most common misconfiguration is specifying the wrong sourcetype or incorrect syntax in the TRANSFORMS directive, which prevents the lookup from being applied at index time. Since the lookup works manually, the issue is with the props.conf configuration, not the lookup file or definition itself.

Exam trap

The trap here is that candidates assume automatic lookups work identically to search-time lookups, but they require explicit configuration in props.conf and transforms.conf, and any syntax error or sourcetype mismatch will silently fail.

How to eliminate wrong answers

Option A is wrong because index-time lookups are supported in Splunk via the TRANSFORMS directive in props.conf, which can enrich events at index time. Option B is wrong because index-time lookups can use CSV files; KV Store is not required. Option C is wrong because automatic lookups are designed to apply without needing the 'lookup' command in searches; they are configured in props.conf and applied at index time.

Full explanation →
3
MCQhard

A security team uses a KV Store lookup to track threat intelligence indicators (IPs, domains) with a field 'indicator' and a field 'threat_type'. They regularly update the KV Store with new indicators. The team notices that searches using the lookup are very slow when the KV Store contains over 100,000 entries. They want to improve lookup performance without losing the ability to update frequently. Which approach should they take?

A.Split the KV Store into multiple smaller KV Stores based on threat_type
B.Convert the KV Store to a CSV file and use the lookup command
C.Add an index on the 'indicator' field in the KV Store collection to speed up lookup queries
D.Increase the memory allocation for the Splunk search head
AnswerC

Indexing the lookup field reduces search time when matching events.

Why this answer

Option C is correct because adding an index on the 'indicator' field in the KV Store collection allows Splunk to perform faster lookups by using a B-tree or similar index structure, reducing the need for a full collection scan. This directly addresses the performance degradation seen with over 100,000 entries while still supporting frequent updates, as indexes are maintained dynamically.

Exam trap

Splunk often tests the misconception that splitting data or increasing hardware resources is the primary solution for performance issues, when in fact proper indexing is the correct database optimization technique for KV Store lookups.

How to eliminate wrong answers

Option A is wrong because splitting the KV Store into multiple smaller stores based on threat_type would require the search to query multiple collections or use a union, adding complexity and potentially still scanning all entries if the indicator is not tied to a specific threat_type. Option B is wrong because converting to a CSV file and using the lookup command would remove the ability to update frequently (CSV files are static unless regenerated) and would not improve performance for large datasets, as CSV lookups are loaded entirely into memory. Option D is wrong because increasing memory allocation for the Splunk search head does not optimize the KV Store lookup itself; it may help with overall search performance but does not address the root cause of slow KV Store queries, which is the lack of an index on the lookup field.

Full explanation →
4
MCQhard

You are a Splunk administrator for a large e-commerce company. The company ingests approximately 500 GB of web server logs per day into a single index named 'web_logs'. A data model named 'Web_Transactions' has been created to analyze user browsing behavior. The data model has a root event with no constraints, and three child objects: 'Page_Views', 'Searches', and 'Purchases'. Each child object has a constraint based on a key-value pair in the logs: e.g., 'action=view', 'action=search', 'action=purchase'. The data model is accelerated with a 7-day summary, but reports that query specific child objects are taking over 10 minutes to return. The reports use |tstats and filter on common fields like 'user_id' and 'session_id'. The admin suspects the acceleration summary is too large. Which of the following actions will most effectively reduce report latency while maintaining the ability to analyze all three transaction types?

A.Use the |datamodel command with the 'search' parameter instead of |tstats.
B.Remove the child objects and use only the root event for all reports.
C.Increase the acceleration summary time range to 30 days to capture more data in one summary.
D.Add a constraint to the root event to include only events that match the action field values (view, search, purchase).
AnswerD

Reduces the summary size by excluding non-relevant events.

Why this answer

Option D is correct because adding a constraint to the root event to filter only events with action=view, action=search, or action=purchase reduces the size of the acceleration summary. The root event currently has no constraints, so the acceleration summary includes all 500 GB of daily web logs, even though only three action types are needed. By constraining the root event, the summary stores only relevant data, making |tstats queries on child objects much faster.

Exam trap

The trap here is that candidates may think increasing the acceleration time range will help by caching more data, but it actually exacerbates the problem by making the summary larger and slower to query.

How to eliminate wrong answers

Option A is wrong because using |datamodel with the 'search' parameter does not leverage acceleration; it runs a real-time search against raw data, which would be slower than using |tstats on an accelerated data model. Option B is wrong because removing child objects and using only the root event would require manual filtering for each transaction type, eliminating the structured acceleration benefits and likely increasing query complexity and latency. Option C is wrong because increasing the acceleration summary time range to 30 days would make the summary even larger, worsening the performance issue rather than solving it.

Full explanation →
5
Multi-Selectmedium

Which THREE best practices should be followed when creating dashboards for a large organization with many users?

Select 3 answers
A.Use scheduled searches instead of real-time to reduce load
B.Limit the number of panels to avoid clutter and improve performance
C.Use multiple base searches per panel for flexibility
D.Apply role-based access controls to dashboard elements
E.Use exclusively real-time searches for up-to-date data
AnswersA, B, D

Scheduled searches minimize real-time indexer load and are recommended for large environments.

Why this answer

Option A is correct because scheduled searches run at defined intervals and cache results, reducing the load on indexers and search heads compared to real-time searches that continuously stream data. This is especially important in large organizations with many users, as real-time searches can consume significant system resources and degrade performance for all users.

Exam trap

Splunk often tests the misconception that using multiple base searches per panel provides flexibility, but in reality it increases load and complexity, and the best practice is to minimize base searches and use post-process searches or chain searches instead.

Full explanation →
6
MCQhard

Refer to the exhibit. An administrator configures a default stanza in props.conf to assign the Authentication data model to all sourcetypes. Which issue might arise?

A.Only authentication tagged events will be included.
B.The data model will work correctly for all events if they contain authentication fields.
C.All events will be mapped to the Authentication data model, increasing resource usage and potential inaccuracies.
D.The data model acceleration will automatically adjust.
AnswerC

This is inefficient and may cause performance issues.

Why this answer

Setting a default stanza in props.conf to assign the Authentication data model to all sourcetypes forces every event to be processed against that data model, regardless of whether the event contains authentication-related data. This increases resource consumption (CPU and memory) because the data model's field extractions and transformations are applied universally, and it can lead to inaccurate results as non-authentication events may produce false positives or incomplete mappings. The correct approach is to use specific sourcetype stanzas or tags to limit data model assignment to relevant events.

Exam trap

The trap here is that candidates assume a default stanza is a harmless catch-all configuration, but in reality it forces universal data model processing, leading to performance degradation and data integrity issues.

How to eliminate wrong answers

Option A is wrong because the default stanza does not filter events by tag; it applies the data model to all sourcetypes, so events without authentication tags are still processed, not excluded. Option B is wrong because the data model will not work correctly for all events; it relies on specific field extractions and constraints defined in the Authentication data model, and events lacking those fields will cause mapping errors or unnecessary processing. Option D is wrong because data model acceleration does not automatically adjust based on a default stanza; acceleration settings must be explicitly configured in the data model definition or via the UI, and a default stanza does not trigger any automatic tuning.

Full explanation →
7
MCQmedium

A medium-sized company uses Splunk to monitor its e-commerce platform. The platform generates around 10 million events per day from web servers, application logs, and databases. The security team wants to identify the top 10 IP addresses that trigger the most 403 Forbidden errors in the last 24 hours. However, when they run the search: index=ecom sourcetype=web status=403 | top src_ip, the search takes over 5 minutes to complete and sometimes times out. The team needs a faster approach that still accurately identifies the top IPs. The team's Splunk environment uses indexers and a search head. The data is not accelerated. What should the team do to improve search performance?

A.Replace 'top' with 'rare' to reduce the amount of data processed
B.Use 'stats count by src_ip | sort - count | head 10' instead of top
C.Add 'fields src_ip' before top to remove other fields
D.Create a report acceleration summary for the search or implement summary indexing
AnswerD

Acceleration pre-computes results, so on-demand searches are fast.

Why this answer

Option D is correct because report acceleration or summary indexing pre-computes and stores the results of the search, allowing subsequent runs to retrieve the aggregated data almost instantly. Given the environment has indexers and a search head but no acceleration, enabling report acceleration on the search creates a summary that updates periodically, bypassing the need to scan all raw events each time. This directly addresses the timeout issue by reducing the per-search data volume to the pre-built summary.

Exam trap

The trap here is that candidates often think minor command changes (like using 'stats' instead of 'top' or adding 'fields') will significantly improve performance, when in reality the bottleneck is the full scan of 10 million events, which only data aggregation techniques like summary indexing or report acceleration can solve.

How to eliminate wrong answers

Option A is wrong because 'rare' finds the least common values, not the top IPs, and would still process the same volume of data, so it does not improve performance. Option B is wrong because while 'stats count by src_ip | sort - count | head 10' is functionally equivalent to 'top', it still requires scanning all events in the time range and does not reduce the data processing load; the performance gain is negligible. Option C is wrong because 'fields src_ip' only removes other fields from the results after the events are already retrieved and processed, so it does not reduce the amount of data scanned or the search time.

Full explanation →
8
MCQeasy

A new Splunk user logs in and sees the Home page. What is the most direct way to start searching data?

A.Click on the 'Home' button on the top left.
B.Go to 'Settings' and select 'Search'.
C.Click on 'Search & Reporting' in the App bar.
D.Type a search query directly into the Home page search bar.
AnswerC

This launches the search interface.

Why this answer

Option B is correct because the Search & Reporting app is the primary search interface. Option A is wrong because the Home page is for navigation overview, not direct search. Option C is wrong because Settings is for configuration.

Option D is wrong because the App bar lists installed apps but does not execute searches.

Full explanation →
9
Multi-Selecthard

Which TWO are valid methods to share a dashboard with other users without granting them edit permissions?

Select 2 answers
A.Embed the dashboard in an external website
B.Clone the dashboard and give the clone to users
C.Add the dashboard to a dashboard group with view permissions
D.Share the dashboard's URL with users who have read access
E.Export the dashboard as a PDF and email it
AnswersC, D

Controls access.

Why this answer

Option C is correct because Splunk allows you to add a dashboard to a dashboard group and set the group's permissions to 'read' (view) only. This grants users access to view the dashboard without the ability to edit it, as edit permissions are controlled separately via roles and object-level ACLs.

Exam trap

The trap here is that candidates confuse 'sharing a URL' (which only works if the user already has read access) with a permission-granting method, and they overlook that cloning does not automatically restrict edit permissions—it creates a new dashboard the recipient can edit unless permissions are explicitly set.

Full explanation →
10
Drag & Dropmedium

Drag and drop the steps to perform a Splunk software upgrade using the CLI into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Upgrade procedure includes backup, download, stop, install, and verification.

Full explanation →
11
Drag & Dropmedium

Drag and drop the steps to configure Splunk to use LDAP authentication into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

LDAP setup involves selecting the method, configuring server details, mapping groups, and testing.

Full explanation →
12
MCQmedium

A user wants to replace a field value 'ERROR' with 'Error' in search results. Which command should be used within a search to achieve this transformation?

A.rex field=_raw 's/ERROR/Error/g'
B.eval severity=replace(severity, "ERROR", "Error")
C.lookup severity_lookup severity OUTPUT new_severity
D.convert ctime(_time)
AnswerB

eval with replace function modifies the field value.

Why this answer

Option B is correct because the `replace` function in the `eval` command performs a case-sensitive string replacement on a specific field. In this case, it replaces the exact string 'ERROR' with 'Error' in the `severity` field, which is the precise transformation requested. Unlike `rex`, `replace` does not require regex syntax and directly modifies the field value without affecting other parts of the event.

Exam trap

Splunk often tests the distinction between `rex` (which modifies raw text or a field using regex) and `eval` with `replace` (which performs a simple string replacement on a specific field), leading candidates to choose `rex` when a field-level substitution is needed.

How to eliminate wrong answers

Option A is wrong because `rex field=_raw 's/ERROR/Error/g'` applies a regex substitution to the entire `_raw` field, not to a specific field like `severity`, and it would modify all occurrences of 'ERROR' in the raw event text, which is not the requested transformation. Option C is wrong because a lookup command is used to enrich events with external data or map values from a CSV or KV store, not to perform a simple string replacement within a field. Option D is wrong because `convert ctime(_time)` converts a timestamp from epoch format to a human-readable time string, which has nothing to do with replacing a field value.

Full explanation →
13
MCQeasy

An analyst runs a search and notices that a field `status_code` contains values like '200', '404', '500'. They want to categorize these as 'Success' or 'Error'. Which approach is most efficient?

A.Use the csv file as a lookup and inputlookup to filter.
B.Use eval with case function to map status codes to categories directly in the search.
C.Create a lookup table with status codes and categories, then use the lookup command.
D.Use the rename command to change field values.
AnswerB

Eval case is efficient and easy to write for simple mappings.

Why this answer

Option B is correct because using `eval` with `case` is the most efficient approach for a simple, static mapping of status codes to categories directly within the search pipeline. It avoids the overhead of disk I/O and lookup table management, and it executes entirely in memory on the search head or indexer, making it ideal for small, hardcoded mappings.

Exam trap

Splunk often tests the distinction between `eval` with `case` (inline transformation) and lookup-based approaches, trapping candidates who over-engineer a solution by choosing a lookup when a simple `eval` is more efficient and appropriate.

How to eliminate wrong answers

Option A is wrong because `inputlookup` is used to load an entire lookup file into the search, not to filter or map field values; it would require a separate lookup table and adds unnecessary complexity. Option C is wrong because creating a lookup table and using the `lookup` command introduces file-based I/O and is overkill for a simple static mapping that can be done inline with `eval`. Option D is wrong because `rename` only changes the name of a field, not its values, so it cannot transform '200' into 'Success'.

Full explanation →
14
MCQeasy

Refer to the exhibit. An analyst wants to see the top 10 most visited URI paths, but the result also includes a 'percent' column. To remove the percent column, which command should be added?

A.| table uri_path count
B.| eval percent=null()
C.| rename percent as ""
D.| fields - percent
AnswerD

Directly removes the percent field.

Why this answer

The `fields` command with a minus sign removes specified fields from the results. Since the question asks to remove the 'percent' column, `| fields - percent` is the correct and most direct way to drop that field while keeping all other fields intact.

Exam trap

The trap here is that candidates often confuse removing a field with hiding it or setting it to null, leading them to choose `eval percent=null()` or `rename percent as ""` instead of using the explicit `fields -` syntax for field removal.

How to eliminate wrong answers

Option A is wrong because `| table uri_path count` would create a table with only those two columns, but it would also discard any other fields (like the URI path and count data) and does not explicitly remove the percent column. Option B is wrong because `| eval percent=null()` sets the percent field to null but does not remove the field from the output; the column would still appear with empty values. Option C is wrong because `| rename percent as ""` attempts to rename the field to an empty string, which is invalid in Splunk and would either cause an error or leave the field with an empty name, not remove it.

Full explanation →
15
MCQhard

A search returns no results. The user has verified that data is being indexed. What is the most likely cause?

A.The search term is misspelled
B.The search is using incorrect index name
C.The time range picker is set incorrectly
D.The user lacks search permissions
AnswerC

Most common cause if data is indexed.

Why this answer

The most likely cause is that the time range picker is set incorrectly. Even if data is being indexed and the search terms are correct, Splunk restricts search results to the selected time range. If the time range does not cover the period when the data was indexed, the search will return no results.

This is a common issue because the default time range is often set to "Last 24 hours" or "All time" depending on the user's last selection.

Exam trap

Splunk often tests the misconception that search syntax or permissions are the primary cause of zero results, when in fact the time range picker is the most common and easily overlooked setting that can silently exclude all events.

How to eliminate wrong answers

Option A is wrong because a misspelled search term would typically return zero results even if data exists, but the question states the user has verified data is being indexed, implying the search is syntactically correct; however, the most common cause is time range, not spelling. Option B is wrong because using an incorrect index name would also return no results, but the user has verified data is being indexed, which usually means they know the correct index; the time range issue is more subtle and frequent. Option D is wrong because lacking search permissions would typically result in an error message or no results across all time ranges, not just a specific time window, and the user has verified data is indexed, which implies they have at least some access.

Full explanation →
16
MCQhard

A search using index=security sourcetype=windows_security returns events with EventCode=4625. The user wants to find the top 10 source IP addresses. Which search will accomplish this?

A.index=security sourcetype=windows_security EventCode=4625 | rex field=Account "from (\d+\.\d+\.\d+\.\d+)" | top 10 ip
B.index=security sourcetype=windows_security EventCode=4625 | top 10 Account
C.index=security sourcetype=windows_security | top 10 src_ip
D.index=security sourcetype=windows_security EventCode=4625 | table Account | top 10
AnswerA

This extracts the IP from the Account field and then finds top 10.

Why this answer

Option A is correct because it first filters for EventCode=4625 (failed logon events), then uses a regular expression with `rex` to extract the source IP address from the `Account` field (which in Windows security logs for event 4625 contains the source IP in the format 'from x.x.x.x'), and finally uses `top 10` to display the ten most frequent IP addresses. This directly answers the user's requirement to find the top 10 source IP addresses from the failed logon events.

Exam trap

The trap here is that candidates may assume the source IP is stored in a dedicated field like `src_ip` or `source_ip` in Windows security logs, but in reality for event 4625, the IP is embedded within the `Account` field and must be extracted using regex.

How to eliminate wrong answers

Option B is wrong because `top 10 Account` would return the top 10 values of the `Account` field (which typically contains usernames, not IP addresses), so it does not identify source IPs. Option C is wrong because it lacks the `EventCode=4625` filter, so it would include all Windows security events (not just failed logons), and it uses `src_ip` which is not a standard field name in Windows security logs for event 4625 (the IP is embedded in the `Account` field). Option D is wrong because `table Account` first reduces the results to only the `Account` field, then `top 10` would count the top 10 account names (usernames), not IP addresses, and the IP extraction step is missing.

Full explanation →
17
MCQhard

A compliance report must show the average latency per service for each hour over the past 30 days. The data set contains millions of events. To ensure the report finishes within a reasonable time, which approach is recommended?

A.Use the tstats command over a data model
B.Use timechart span=1h avg(latency) by service
C.Use stats avg(latency) by service, _time span=1h
D.Pre-process data using a summary index that runs hourly
AnswerA

tstats leverages acceleration and is optimized for large datasets.

Why this answer

The tstats command is optimized for use with data models and runs on indexed fields in the tsidx files, making it far faster than stats or timechart on raw events for large datasets. By pre-defining a data model with the latency field and using tstats, you avoid scanning millions of raw events and instead query pre-aggregated statistics, ensuring the report completes within a reasonable time.

Exam trap

Splunk often tests the misconception that timechart or stats with span is sufficient for large datasets, but the trap here is that candidates overlook the performance advantage of tstats over a data model, which is specifically designed for high-speed aggregation on massive datasets.

How to eliminate wrong answers

Option B is wrong because timechart operates on raw events, requiring a full scan of all events over 30 days, which is inefficient for millions of events and will likely time out or run slowly. Option C is wrong because stats with _time span=1h also processes raw events and does not leverage any pre-computed indexes or data models, leading to the same performance issue. Option D is wrong because while a summary index can improve performance, the question asks for an approach that ensures the report finishes within a reasonable time given the existing data set, and pre-processing with a summary index requires additional setup and maintenance; the recommended approach for immediate use is tstats over a data model.

Full explanation →
18
MCQhard

A user runs a search and uses `| lookup mylookup myfield OUTPUT myfield2`. The search returns events that have myfield values, but myfield2 is null. The lookup file has matching entries. What is the most likely issue?

A.The lookup definition is case-sensitive and the event values have different case.
B.The lookup definition is missing the max_matches setting.
C.The lookup file has duplicate keys.
D.The lookup command should use OUTPUTNEW instead of OUTPUT.
AnswerA

Case mismatch prevents matching.

Why this answer

Option A is correct because the lookup definition in Splunk has a case-sensitivity setting. By default, lookups are case-insensitive, but if the lookup definition is configured to be case-sensitive, then the lookup will only match when the case of the event field value exactly matches the case in the lookup file. Since the events have myfield values but myfield2 is null, the lookup is failing to match due to case differences, even though the lookup file has matching entries.

Exam trap

Splunk often tests the nuance between case-sensitive and case-insensitive lookups, and the trap here is that candidates assume lookups are always case-insensitive by default, forgetting that the lookup definition can be explicitly configured for case-sensitive matching.

How to eliminate wrong answers

Option B is wrong because the max_matches setting controls the maximum number of rows returned per input value, not whether a match occurs; a missing max_matches setting would not cause null output for matching entries. Option C is wrong because duplicate keys in the lookup file would cause multiple matches, not null values; Splink would still return a value for myfield2, possibly the first match. Option D is wrong because OUTPUTNEW is used to prevent overwriting existing field values, but the issue here is that myfield2 is null, meaning no match was found; using OUTPUTNEW would not change the outcome if the lookup fails to match.

Full explanation →
19
MCQmedium

An IT administrator has a dashboard with multiple panels that all use the same base search but with different post-processing filters. The dashboard is slow to load. Which optimization technique is most effective?

A.Implement a base search and use post-process searches
B.Remove data model acceleration from the underlying data
C.Enable report acceleration on each panel
D.Duplicate the base search in each panel
AnswerA

Base search runs once and feeds to post-process panels, improving performance.

Why this answer

Option B is correct because using a base search with post-process searches reduces duplication of search execution. Option A is wrong because adding more panels increases load. Option C is wrong because report acceleration is for single reports, not base searches.

Option D is wrong because removing data model acceleration won't help.

Full explanation →
20
MCQmedium

A search returns many duplicate events due to data source redundancy. Which command can remove duplicate events based on a specific field?

A.uniq event_id
B.fields event_id
C.sort event_id
D.dedup event_id
AnswerD

dedup removes duplicates based on the unique values of the event_id field.

Why this answer

The `dedup` command removes duplicate events based on the values of one or more specified fields. In this case, `dedup event_id` will keep only the first occurrence of each unique `event_id` value, discarding subsequent duplicates. This is the correct command for removing duplicate events based on a specific field.

Exam trap

The trap here is that candidates may confuse the Unix `uniq` command (which removes consecutive duplicates) with Splunk's `dedup`, or mistakenly think `sort` or `fields` can eliminate duplicates, when only `dedup` performs field-based deduplication in Splunk.

How to eliminate wrong answers

Option A is wrong because `uniq` is not a valid Splunk command; the correct command for removing consecutive duplicates in a stream is `uniq` in Unix, but Splunk uses `dedup` for field-based deduplication. Option B is wrong because `fields event_id` only retains the `event_id` field in the results, removing all other fields, but does not remove duplicate events. Option C is wrong because `sort event_id` orders events by the `event_id` field but does not remove duplicates; it may even bring duplicates together but leaves them all in the results.

Full explanation →
21
Multi-Selectmedium

Which two of the following are actions that can be performed on a report after it is created? (Choose two.)

Select 2 answers
A.Modify its search query
B.Delete it from the index
C.Embed it in a dashboard
D.Convert it to an alert
E.Schedule it
AnswersC, E

You can add a report as a dashboard panel.

Why this answer

Option C is correct because reports in Splunk can be embedded into dashboards as panels, allowing users to visualize report results directly within a dashboard context. This is done by adding a report panel to a dashboard XML or using the dashboard editor, which references the saved report's search ID (SID) to render the data.

Exam trap

Splunk often tests the distinction between actions that modify a report's definition (like editing the search query) versus actions that use the report as a data source (like embedding or scheduling), leading candidates to incorrectly select 'Modify its search query' as a separate post-creation action when it is actually part of editing the report.

Full explanation →
22
Multi-Selecthard

Which TWO are best practices for designing data models in Splunk?

Select 2 answers
A.Use the same field names across different datasets in the same data model.
B.Define constraints that are as specific as possible to reduce unwanted events.
C.Test the data model using the `| datamodel` command before using in Pivot.
D.Use a flat hierarchy with many fields to avoid complex constraints.
E.Avoid using field aliases because they confuse the data model.
AnswersB, C

Specific constraints improve data model accuracy and performance.

Why this answer

Option B is correct because defining constraints as specifically as possible in a Splunk data model reduces the inclusion of unwanted events, ensuring that only relevant data is processed and improving query performance. This practice aligns with Splunk's recommendation to use precise constraints to filter out noise and maintain data integrity within the data model.

Exam trap

Splunk often tests the misconception that using the same field names across datasets simplifies data models, but in Splunk, this can cause field collisions and data corruption, making unique field names a critical best practice.

Full explanation →
23
Multi-Selecteasy

A user wants to add a panel to an existing dashboard in Splunk. Which TWO of the following methods can be used to achieve this?

Select 2 answers
A.From the dashboard, click 'Clone Panel' on an existing panel.
B.From the dashboard listing, click 'Edit' and then 'Import Panel'.
C.From the search app, click 'Add to Dashboard' after running a search.
D.From a search results page, click 'Save As' and select 'Dashboard Panel'.
E.From the dashboard, click 'Edit Dashboard' then 'Add Panel'.
AnswersD, E

This allows you to save a search as a dashboard panel, adding it to a dashboard.

Why this answer

The correct methods are using 'Edit Dashboard' and 'Add Panel' (Option A) and 'Save As' then selecting 'Dashboard Panel' (Option B). The other options are not standard or do not add a new panel.

Full explanation →
24
MCQhard

Refer to the exhibit. A security analyst runs the search and sees the result table. The analyst wants to see only the top 3 URI paths with their counts, without the percentage column. Which command modification achieves this?

A.`index=web sourcetype=access_combined | top limit=3 uri_path | fields - percent`
B.`index=web sourcetype=access_combined | top uri_path | head 3`
C.`index=web sourcetype=access_combined | top limit=3 showperc=f uri_path`
D.`index=web sourcetype=access_combined | top limit=3 uri_path`
AnswerC

Correct. `limit=3` limits to top 3, `showperc=f` hides the percent column.

Why this answer

Option C is correct because the `top` command's `showperc=f` argument suppresses the percentage column, and `limit=3` restricts the output to the top 3 URI paths. This directly meets the requirement of showing only the top 3 URI paths with their counts, without the percentage column.

Exam trap

Splunk often tests the specific arguments of the `top` command, and the trap here is that candidates may think `fields - percent` is the correct way to remove the percentage column, but the `showperc=f` argument is the proper and more efficient method.

How to eliminate wrong answers

Option A is wrong because the `fields - percent` command removes the percent field after the `top` command runs, but the `top` command by default includes a percent column; using `fields -` is less efficient and not the intended method. Option B is wrong because `head 3` after `top uri_path` will return the first 3 results from the default top 10, but it does not guarantee the top 3 by count and still includes the percent column. Option D is wrong because `top limit=3 uri_path` limits to 3 results but does not suppress the percent column, leaving it visible.

Full explanation →
25
MCQmedium

A Splunk administrator is designing a data model for network traffic logs. The logs contain source IP, destination IP, bytes transferred, and protocol. The administrator wants to create a root event that counts connections and a child transaction that sums bytes per session. Which constraint type should be used for the root event?

A.Child constraint
B.Search constraint
C.Event constraint
D.Transaction constraint
AnswerC

Event constraints define root events as individual log entries.

Why this answer

The root event in a data model must use an Event constraint because it defines the base dataset from which all child objects inherit their data. Event constraints filter raw events based on search criteria, ensuring the root event contains only the relevant network traffic logs (source IP, destination IP, bytes, protocol) needed to count connections. Child constraints, search constraints, and transaction constraints are not valid constraint types for defining the root event in a Splunk data model.

Exam trap

The trap here is that candidates confuse the term 'Event constraint' with 'Search constraint' because the root event uses a search string, but Splunk specifically names it an Event constraint in the data model builder interface and documentation.

How to eliminate wrong answers

Option A is wrong because 'Child constraint' is not a valid constraint type in Splunk data models; child objects use inherited constraints from the root event, not a separate child constraint. Option B is wrong because 'Search constraint' is not a recognized constraint type; while the root event uses a search string to filter events, the formal term for the constraint applied to the root event is an Event constraint. Option D is wrong because 'Transaction constraint' does not exist in Splunk data models; transactions are created using the transaction command or transaction type in data model objects, not as a constraint type for the root event.

Full explanation →
26
MCQhard

A large financial institution uses Splunk to consolidate logs from thousands of ATMs. Each ATM sends a heartbeat event every 5 minutes containing fields: atm_id, timestamp, status (OK or ERROR), and firmware_version. The operations team wants to find the number of ATMs that have reported at least one ERROR status in the last hour. The initial search is: index=atm sourcetype=heartbeat status=ERROR | dedup atm_id | stats count. However, this search returns a count that is too high because some ATMs report multiple errors within the hour. The team needs an accurate count of ATMs that had any error, regardless of how many error events each ATM generated. The search must be efficient due to the high volume of events. Which approach should be used?

A.index=atm sourcetype=heartbeat status=ERROR | stats count(atm_id) as error_events | eval error_events
B.index=atm sourcetype=heartbeat status=ERROR | stats dc(atm_id) as errored_atms
C.index=atm sourcetype=heartbeat status=ERROR | stats count by atm_id | where count >=1 | dedup atm_id | stats count
D.index=atm sourcetype=heartbeat status=ERROR | stats values(atm_id)
AnswerB

Distinct count of atm_id gives the number of ATMs with any error.

Why this answer

Option B is correct because `stats dc(atm_id)` computes the distinct count of `atm_id` values, directly giving the number of unique ATMs that had at least one ERROR event in the last hour. This is efficient as it processes all matching events in a single pass without needing intermediate deduplication or subsearches, which is critical for high-volume ATM log data.

Exam trap

The trap here is that candidates may think `dedup atm_id` followed by `stats count` is necessary to get unique ATMs, but they overlook that `stats dc(atm_id)` achieves the same result more efficiently and is the standard Splunk command for distinct counts.

How to eliminate wrong answers

Option A is wrong because `stats count(atm_id)` counts all error events (including duplicates), not unique ATMs, and the `eval` is incomplete. Option C is wrong because it first counts events per ATM, then filters with `where count >=1` (redundant since all have at least one), then `dedup atm_id` (unnecessary and wasteful), and finally `stats count` — this is inefficient and overcomplicates the task. Option D is wrong because `stats values(atm_id)` returns a multivalue list of all ATM IDs that had errors, not a count, so it does not answer the question.

Full explanation →
27
Multi-Selectmedium

Which two components are required to create a time-based chart of average CPU usage per host over the last 4 hours? (Choose two.)

Select 2 answers
A.timechart avg(cpu) by host
B.A time range modifier like earliest=-4h
C.stats avg(cpu) by host
D.the top command
E.the fields command
AnswersA, B

Required to create time-based chart.

Why this answer

Option A is correct because `timechart` is the Splunk command specifically designed to create time-based charts, and `avg(cpu) by host` computes the average CPU usage aggregated per host over time. This command automatically splits the results into time buckets and generates a chart with time on the x-axis and the average CPU per host as series.

Exam trap

Splunk often tests the distinction between `timechart` and `stats`; the trap here is that candidates may think `stats` with a time range modifier is sufficient, but `stats` alone cannot produce a time-based chart without an explicit `bin` command and additional formatting.

Full explanation →
28
MCQhard

A security team wants to add department info from an external CSV file to events containing user IDs. The CSV has columns 'userid' and 'department'. What is the correct configuration?

A.Define a lookup definition, then use | inputlookup department.csv
B.Define a lookup definition with userid as input field and department as output field, then use | lookup department_lookup userid OUTPUT department
C.Define a lookup table, then use | lookup department.csv userid OUTPUT department
D.Use | join userid with department.csv
AnswerB

This is the correct sequence: define lookup definition and use lookup command.

Why this answer

The correct Splunk approach is to define a lookup definition (via Settings > Lookups), then use the lookup command with the definition name and matching fields.

Full explanation →
29
MCQhard

A data model for web traffic has a child dataset 'Error_Pages' that should only include events with status code 5xx. The admin wants to ensure that when the data model is used with tstats, only these events are searched. Which definition should they use in the data model?

A.Add a constraint: status>=500 AND status<=599
B.Add a filter: status>=500 AND status<=599
C.Use a tag: error_tag for status>=500
D.Use a calculated field: error=(status>=500)
AnswerA

Constraints define which events belong to a dataset for acceleration.

Why this answer

Option A is correct because constraints in a Splunk data model define the base search that restricts which events are included in a child dataset. By adding a constraint of `status>=500 AND status<=599`, the Error_Pages dataset will only contain events with HTTP status codes in the 5xx range. When `tstats` is used against this dataset, it automatically respects the constraint, ensuring only those events are searched without needing additional filters at query time.

Exam trap

Splunk often tests the distinction between constraints (which define dataset membership) and filters (which are applied at search time), leading candidates to mistakenly choose filters because they think they restrict events in the same way.

How to eliminate wrong answers

Option B is wrong because filters in a data model are applied at search time, not at indexing or dataset definition time; they do not restrict which events are stored in the child dataset, so `tstats` would still search all events unless a filter is explicitly added in the search. Option C is wrong because tags are metadata labels applied to events, not a mechanism to restrict dataset membership; using a tag would require manual tagging and does not enforce a constraint for `tstats`. Option D is wrong because calculated fields derive new field values from existing data but do not limit which events are included in a dataset; they are computed at search time and do not affect the base search of the child dataset.

Full explanation →
30
MCQhard

A user notices that a search is taking a long time and wants to see detailed performance breakdown. Which tool in Splunk Web should they use?

A.Check the 'Fields' sidebar for the number of events returned.
B.Look at the timeline zoom levels to estimate processing time.
C.Use the 'Search History' to view previous search run times.
D.Open the 'Job Inspector' from the search action menu.
AnswerD

Job Inspector gives granular performance data.

Why this answer

The Job Inspector provides a detailed performance breakdown of a search, including execution time, resource consumption, and component-level statistics. It is the correct tool in Splunk Web for diagnosing slow searches because it reveals exactly where time is spent, such as in search dispatch, data retrieval, or post-processing.

Exam trap

The trap here is that candidates may confuse the Job Inspector with simpler tools like Search History or the Fields sidebar, thinking that event counts or past run times provide the same level of diagnostic detail, but only the Job Inspector offers a granular performance breakdown.

How to eliminate wrong answers

Option A is wrong because the 'Fields' sidebar shows field extractions and event counts, not performance metrics or a breakdown of search execution time. Option B is wrong because timeline zoom levels adjust the time range for visualization, not provide a performance breakdown of the search process. Option C is wrong because 'Search History' lists past searches and their run times, but does not offer a detailed performance breakdown or component-level analysis of a specific search.

Full explanation →
31
Multi-Selecthard

Which THREE of the following are valid uses of the stats command?

Select 3 answers
A.stats eval(x=1) by category
B.stats avg(response_time) as avg_time
C.stats sum(bytes) by source
D.stats count by host
E.stats table user
AnswersB, C, D

Valid stats function avg with alias.

Why this answer

Option B is correct because the `stats` command supports aggregation functions like `avg()` to compute the average of a field, and the `as` clause renames the resulting field. This is a standard and valid use of `stats` for statistical summarization.

Exam trap

Splunk often tests the distinction between `stats` and other transforming commands like `eval` or `table`, trapping candidates who confuse the syntax or assume all commands can be nested within `stats`.

Full explanation →
32
Multi-Selectmedium

Which THREE statements about Splunk lookups are true?

Select 3 answers
A.Lookups are automatically applied to all events in a search.
B.Lookups can only be performed on a single field.
C.Lookups can be defined in the Lookups section of Settings.
D.Lookups can be configured to run automatically when a field appears in an event.
E.Lookups can be used to add field values from an external source to your search results.
AnswersC, D, E

Lookup definitions are managed in Settings > Lookups.

Why this answer

Option C is correct because Splunk lookups are defined and managed in the Lookups section under Settings > Lookups, where you can upload lookup files, create lookup definitions, and configure automatic lookups. This is the central location for all lookup configuration, including CSV files, KV store collections, and external lookups.

Exam trap

Splunk often tests the misconception that lookups are automatically applied to all events, when in fact they require explicit invocation or automatic lookup configuration tied to specific fields.

Full explanation →
33
MCQhard

Refer to the exhibit. What can be determined about the license usage?

A.320 MB of license is used for search
B.The pool is over-allocated
C.The license is expired
D.180 MB of license capacity is available
AnswerD

500 - 320 = 180 MB available.

Why this answer

The pool has a max size of 500 MB and used size of 320 MB, meaning 180 MB is available. The pool is not full. The stack ID indicates it's for enterprise license, but not necessarily all used for search.

The pool is not over-allocated.

Full explanation →
34
MCQhard

A Splunk admin is troubleshooting a slow report that uses an accelerated data model. The report uses tstats commands and filters on a field that is not a constraint field in the data model. Which of the following best explains why the report is slow?

A.The acceleration summary for that data model has not been rebuilt recently, causing outdated data.
B.The report is using the data model incorrectly; it should use |datamodel instead of |tstats.
C.The field used in the filter is not defined as a constraint field in the data model, so tstats cannot use acceleration for that filter.
D.The time range is too broad, causing the acceleration summary to include too many events.
AnswerC

Filtering on non-constraint fields forces full event search.

Why this answer

C is correct because `tstats` relies on acceleration summaries that are built only for fields defined as constraint fields in the data model. When a filter is applied on a non-constraint field, `tstats` cannot use the pre-computed acceleration summary and must fall back to scanning the raw events, which significantly degrades performance.

Exam trap

The trap here is that candidates assume `tstats` always uses acceleration regardless of the fields involved, but Splunk specifically restricts acceleration to constraint fields defined in the data model.

How to eliminate wrong answers

Option A is wrong because the slowness is not due to the acceleration summary being outdated; even a freshly rebuilt summary cannot accelerate a filter on a non-constraint field. Option B is wrong because `tstats` is the correct command to query accelerated data models; `|datamodel` is used for other purposes like generating field aliases and does not directly leverage acceleration. Option D is wrong because a broad time range does not inherently cause slowness if the filter is on a constraint field; the acceleration summary is designed to handle large time ranges efficiently.

Full explanation →
35
MCQhard

A security team needs to track authentication events across multiple sources: Windows Security logs, Linux /var/log/auth.log, and network authentication events. They want to create a single data model covering all authentication events with consistent field names. Which best practice should they follow?

A.Define the data model with a single dataset and use the 'tag' command to categorize events.
B.Use the same data model with constraints to filter each sourcetype into the correct dataset.
C.Create a data model with multiple root events, one per sourcetype.
D.Create separate data models for each source to avoid conflicts.
AnswerB

This normalizes fields across sources and allows efficient searching.

Why this answer

Option B is correct because Splunk data models use constraints to route events from different sourcetypes into specific datasets within a single data model. This allows the security team to normalize authentication events from Windows Security logs, Linux auth.log, and network authentication sources into consistent field names (e.g., user, src_ip, action) while preserving the ability to search across all sources. Using a single data model with constraints ensures field name consistency and avoids duplication of effort.

Exam trap

The trap here is that candidates confuse the 'tag' command (which adds metadata at search time) with data model constraints (which filter events into datasets at index time or acceleration time), leading them to choose Option A instead of B.

How to eliminate wrong answers

Option A is wrong because the 'tag' command is used to add metadata to events at search time, not to define dataset membership or field normalization within a data model; data models require constraints, not tags, to filter events into datasets. Option C is wrong because a data model can have only one root event (the base search), and multiple root events are not supported; you cannot create one root event per sourcetype within a single data model. Option D is wrong because creating separate data models for each source would prevent unified searching and consistent field naming across authentication events, defeating the purpose of a single data model.

Full explanation →
36
MCQhard

This is a props.conf configuration snippet. What does it configure?

A.Global default values for host, index, and sourcetype.
B.Settings for the host server1.
C.Settings for the syslog sourcetype.
D.Default values for all inputs.
AnswerA

The [default] stanza applies to all data that doesn't have its own stanza.

Why this answer

Option A is correct because the `[default]` stanza in props.conf sets global default values for host, index, and sourcetype that apply to all data inputs unless overridden by a more specific stanza. This stanza is processed first and provides fallback values for any event that does not match a source, sourcetype, or host-specific configuration.

Exam trap

The trap here is that candidates confuse the `[default]` stanza in props.conf with input-level defaults set in inputs.conf, or mistakenly think it applies only to a specific sourcetype or host, when in fact it is a global fallback for event parsing attributes.

How to eliminate wrong answers

Option B is wrong because the snippet uses the `[default]` stanza, not a host-specific stanza like `[host::server1]`, which would require explicit host matching. Option C is wrong because the `[default]` stanza applies globally, not specifically to the syslog sourcetype; a sourcetype-specific stanza would be `[syslog]`. Option D is wrong because props.conf configures event processing and parsing rules, not input definitions (which are set in inputs.conf); the `[default]` stanza here sets default values for host, index, and sourcetype, not default values for all inputs.

Full explanation →
37
MCQmedium

A user needs to export search results to a CSV file for further analysis. Which method is the most straightforward?

A.Click the Export button and select CSV.
B.Use the | outputcsv command.
C.Use the | csv command.
D.Use the | append command.
AnswerA

Directly downloads a CSV file to the browser.

Why this answer

Option A is correct because clicking the Export button and selecting CSV is the most straightforward method for exporting search results to a CSV file in Splunk. This GUI-based approach requires no knowledge of specific commands and is accessible directly from the Search & Reporting app's results page, making it ideal for quick data extraction without altering the search logic.

Exam trap

The trap here is that candidates often confuse the | outputcsv command (which writes to the server) with the Export button (which downloads to the client), or they may incorrectly recall a non-existent | csv command, leading them to choose a less straightforward or invalid option.

How to eliminate wrong answers

Option B is wrong because the | outputcsv command writes results to a CSV file on the Splunk server's file system, not to the user's local machine, and requires command-line syntax, making it less straightforward for most users. Option C is wrong because there is no | csv command in Splunk; the correct command for outputting CSV is | outputcsv, and | csv is not a valid SPL command. Option D is wrong because the | append command is used to combine results from multiple searches, not to export data to a CSV file.

Full explanation →
38
MCQmedium

A user created a dashboard panel with a search that uses a token. The token is not being applied when the user modifies the dropdown. What is the most likely cause?

A.The input has a default value that overrides user selections
B.The dashboard is set to 'disabled' mode
C.The token name in the search does not match the token in the input
D.The panel is set to 'static'
AnswerC

Token names are case-sensitive and must match exactly for the input to control the search.

Why this answer

Option C is correct because for a token to dynamically filter search results in a Splunk dashboard, the token name referenced in the search string (e.g., `$token_name$`) must exactly match the token name defined in the input's `token` attribute. If these names differ, the search will not receive the selected value, and the token will appear unapplied.

Exam trap

Splunk often tests the candidate's attention to detail by presenting a scenario where the token appears correctly configured but the names are subtly mismatched (e.g., case sensitivity or extra characters), leading candidates to overlook the exact token name alignment.

How to eliminate wrong answers

Option A is wrong because a default value does not override user selections; it only sets the initial value before the user interacts, and once the user selects a new value, the token updates. Option B is wrong because 'disabled' mode prevents the dashboard from running searches at all, not just failing to apply a token from a dropdown. Option D is wrong because a 'static' panel does not run a search, so the token mismatch would not be the issue; the panel would simply display static content regardless of token changes.

Full explanation →
39
MCQmedium

An analyst creates a dashboard with multiple panels. One panel shows a table of top users by login count. The analyst wants to add a second panel that updates based on the user clicked in the first panel. Which feature should be used?

A.Schedule the first panel as a report and the second as a related report.
B.Enable drilldown on the first panel to set a token, and reference that token in the second panel's search.
C.Use the same chart type for both panels to ensure consistency.
D.Set both panels to use the same time range picker.
AnswerB

Token passing enables inter-panel communication.

Why this answer

Drilldown in Splunk allows you to pass context from one panel to another by setting tokens when a user clicks on a value. The first panel's drilldown can set a token (e.g., `$clicked_user$`) which is then referenced in the second panel's search using `| search user=$clicked_user$`. This enables dynamic filtering without requiring separate reports or manual interaction.

Exam trap

The trap here is that candidates confuse visual consistency (same chart type) or time synchronization with the interactive data-linking capability that only drilldown and tokens provide.

How to eliminate wrong answers

Option A is wrong because scheduling panels as reports does not enable interactive cross-panel filtering; reports are static snapshots, not dynamic linked views. Option C is wrong because using the same chart type ensures visual consistency but has no effect on data interaction or token passing between panels. Option D is wrong because setting both panels to the same time range picker only synchronizes time selection, not user-specific click interactions.

Full explanation →
40
MCQhard

A power user creates a dashboard with a panel that uses a search returning 10,000 events. The dashboard should display a single value representing the count of unique users. Which search approach is most efficient?

A.Search index=main | eval user=lower(user) | stats dc(user)
B.Search index=main | fields user | dedup user | stats count
C.Search index=main | stats dc(user) as unique_users
D.Search index=main | table user | stats dc(user)
AnswerC

stats dc(user) efficiently counts unique users without returning all events.

Why this answer

Option A is correct because using | stats dc(user) reduces data early, reducing memory. Option B is wrong because bringing back all events is inefficient. Option C is wrong because eval is unnecessary and adds complexity.

Option D is wrong because | table on a large result set uses more memory.

Full explanation →
41
MCQhard

You are a Splunk administrator at a financial services company. The company has a distributed Splunk environment with 10 indexers and 2 search heads. You have created a data model named 'transaction_analytics' to analyze financial transactions. The data model is accelerated with a summary range of 7 days. Recently, users have reported that dashboards using this data model are extremely slow, sometimes timing out. You check the acceleration status and see that the summary is 'Building' but never completes. The splunkd.log on the search head shows repeated messages: 'Data model acceleration: query timed out after 300 seconds.' The base search for the data model is: index=transactions sourcetype=fin_events | eval risk_score=if(amount>10000, 'high', 'low') | fields transaction_id, user, amount, risk_score, _time. The data model has one root event with two child datasets: one for high-risk transactions and one for low-risk transactions. The total data volume is about 500 GB per day. The indexer where the summary is built has 16 GB of RAM and the search head has 32 GB. What is the best course of action to resolve the acceleration build timeout?

A.Modify the base search to remove the eval statement and instead use a lookup or index-time field for risk_score.
B.Reduce the summary range to 1 day to limit the amount of data processed.
C.Disable acceleration and rely on real-time searches for the dashboards.
D.Increase the acceleration.max_time to 600 seconds to allow more time for the build.
AnswerA

Removing the expensive eval reduces search-time computation, allowing the acceleration build to complete within the timeout period.

Why this answer

Option A is correct because the eval statement in the base search forces the acceleration to process every raw event during the summary build, which is computationally expensive and causes the 300-second timeout. By moving the risk_score calculation to index time (e.g., using a calculated field or lookup), the acceleration can use the pre-computed field directly from the indexed data, drastically reducing CPU load and allowing the summary to complete within the timeout window.

Exam trap

The trap here is that candidates often focus on increasing timeouts or reducing data volume (options B and D) instead of recognizing that expensive eval operations in the base search are the true bottleneck, and that index-time field extraction is the proper Splunk best practice for acceleration.

How to eliminate wrong answers

Option B is wrong because reducing the summary range to 1 day only reduces the data volume temporarily; the underlying performance issue is the eval overhead, not the time range, and users need 7 days of data. Option C is wrong because disabling acceleration would force dashboards to run real-time searches against 500 GB/day of raw data, which would be even slower and more likely to timeout. Option D is wrong because increasing acceleration.max_time to 600 seconds only postpones the timeout without addressing the root cause—the eval statement still consumes excessive CPU on every event, and the build may still fail or cause resource exhaustion.

Full explanation →
42
MCQeasy

A security analyst creates a dashboard to monitor failed login attempts over the past 24 hours. Which visualization type is most appropriate for showing the trend of failed logins over time?

A.Line chart
B.Single value
C.Pie chart
D.Scatter plot
AnswerA

Line charts are ideal for showing trends over time.

Why this answer

A line chart is the most appropriate visualization for showing the trend of failed login attempts over time because it plots continuous data points along a time axis, allowing the analyst to easily identify patterns, spikes, or declines in the event count. In Splunk, a timechart command (e.g., `timechart count by action`) generates data that is best rendered as a line chart to display the temporal progression of failed logins over the past 24 hours.

Exam trap

Splunk often tests the misconception that a pie chart can show changes over time because it visually represents parts of a whole, but the trap here is that pie charts are static and cannot display temporal trends, leading candidates to incorrectly choose it for time-series data.

How to eliminate wrong answers

Option B (Single value) is wrong because it displays only a single aggregated number (e.g., total failed logins) and cannot show changes or trends over time, which is the core requirement. Option C (Pie chart) is wrong because it is designed to show proportions of a whole at a single point in time, not trends across a time range; using it for time-series data would obscure temporal patterns. Option D (Scatter plot) is wrong because it is used to show the relationship between two numerical variables (e.g., correlation), not to display a single metric's progression over a continuous time axis, and it would not clearly convey the trend of failed logins.

Full explanation →
43
MCQeasy

Which command reads a lookup file and outputs it as search results?

A.| inputlookup mylookup.csv
B.| outputlookup mylookup.csv
C.| lookup mylookup.csv
D.| lookup definition mylookup
AnswerA

inputlookup outputs lookup contents.

Why this answer

The `| inputlookup mylookup.csv` command reads the specified lookup file (mylookup.csv) from the lookups directory and outputs its contents as search results, making it the correct choice. This command is specifically designed to load a static lookup table into the search pipeline for further processing or inspection.

Exam trap

The trap here is confusing `inputlookup` (which reads and outputs lookup data) with `lookup` (which enriches events) or `outputlookup` (which writes data), leading candidates to choose the wrong command for simply viewing a lookup file's contents.

How to eliminate wrong answers

Option B is wrong because `| outputlookup mylookup.csv` writes search results to a lookup file, not reads it. Option C is wrong because `| lookup mylookup.csv` is invalid syntax; the correct command to enrich events with lookup data is `| lookup mylookup.csv field1 OUTPUT field2` (or similar), and it does not output the lookup file as standalone results. Option D is wrong because `| lookup definition mylookup` retrieves the definition of a lookup configuration (e.g., from transforms.conf), not the data itself.

Full explanation →
44
Multi-Selecteasy

Which two of the following are valid ways to create a report in Splunk? (Choose two.)

Select 2 answers
A.Convert a dashboard panel to a report
B.Schedule an alert
C.Save a search as a report
D.Import an external CSV as a report
E.Use the Report Builder
AnswersC, E

This is the primary method to create a report from an existing search.

Why this answer

Option C is correct because Splunk allows you to save any search as a report directly from the Search & Reporting app. When you run a search and click 'Save As' > 'Report', Splunk stores the search string, time range, and visualization settings as a reusable report object in the knowledge object store. This is a fundamental method for creating reports in Splunk.

Exam trap

The trap here is that candidates often confuse saving a search as a report with converting a dashboard panel, not realizing that Splunk only supports converting reports into dashboard panels, not the reverse.

Full explanation →
45
MCQmedium

Refer to the exhibit. This search produces a table with hosts as rows and status codes as columns. The user wants to visualize this as a stacked column chart showing the distribution of status codes per host. Which chart type should be selected?

A.Stacked column chart
B.Line chart
C.Pie chart
D.Scatter chart
AnswerA

Shows composition per host.

Why this answer

A stacked column chart is the correct choice because the search result is a table with hosts as rows and status codes as columns, representing categorical data (hosts) with multiple subcategories (status codes) that sum to a total per host. The stacked column chart visually shows the distribution of each status code within each host, allowing comparison of both the total count per host and the relative contribution of each status code. This aligns with Splunk's visualization best practices for multi-series categorical data where the sum of parts equals a whole.

Exam trap

The trap here is that candidates may choose a pie chart thinking it shows 'distribution,' but they overlook that a pie chart cannot handle multiple categories (hosts) simultaneously, whereas a stacked column chart correctly represents the hierarchical breakdown per host.

How to eliminate wrong answers

Option B is wrong because a line chart is designed for continuous data over time or a sequential axis, not for categorical comparisons of hosts and status codes where the x-axis is non-numeric. Option C is wrong because a pie chart can only show the proportion of a single categorical variable (e.g., total status codes across all hosts) and cannot represent multiple hosts as separate slices with sub-slices for status codes. Option D is wrong because a scatter chart requires two numeric fields for x and y axes to plot points, but the data here consists of categorical hosts and numeric counts of status codes, lacking a second numeric variable for correlation.

Full explanation →
46
MCQmedium

Your team uses a large CSV lookup 'users.csv' with 200,000 rows. When running searches that use this lookup via the lookup command, performance is slow. Which action would most improve performance?

A.Switch to an external lookup that queries a database
B.Increase the lookup timeout value
C.Add an index to the lookup file by converting to KV Store
D.Increase the max_matches setting for the lookup
AnswerC

KV Store allows indexing on fields, speeding up lookups.

Why this answer

Option B is correct because creating an index on the lookup fields (like using a KV Store or using a time-based lookup with indexed fields) can speed up matching. Alternatively, filtering the lookup before joining reduces rows processed. Option A is wrong because maxmatches is only useful if there are multiple matches.

Option C is wrong because changing to external lookup adds overhead. Option D is wrong because increasing timeout doesn't improve performance.

Full explanation →
47
Multi-Selecteasy

Which TWO of the following are valid ways to access the Search & Reporting app in Splunk Web? (Choose two.)

Select 2 answers
A.Click the 'Search & Reporting' link on the Splunk Home page.
B.Navigate to Settings > Search.
C.Use the Apps menu in the top navigation bar.
D.Type 'search' in the browser address bar.
E.Open the Search Assistant from the Help menu.
AnswersA, C

Correct: Home page links to apps.

Why this answer

Options A and C are correct because the Splunk Home page provides a direct link to the Search & Reporting app, and the Apps menu always lists installed apps. Option B is incorrect because Settings > Search takes you to search preferences, not the app. Option D is incorrect because typing in the address bar does not reliably navigate to the app.

Option E is incorrect because the Search Assistant is a feature within the app, not a navigation method.

Full explanation →
48
MCQeasy

A user wants to create a dashboard panel that refreshes automatically every 60 seconds. Which setting must be configured in the panel's edit mode?

A.Add | delay 60 to the search
B.Set the Refresh Interval to 60 seconds
C.Schedule the search to run every 60 seconds
D.Set the Time Range to Last 60 seconds
AnswerB

Directly sets the auto-refresh time.

Why this answer

Option B is correct because the dashboard panel's edit mode includes a 'Refresh Interval' setting that allows you to specify an automatic refresh period in seconds. Setting this to 60 causes the panel to re-run its underlying search and update the visualization every 60 seconds without manual intervention.

Exam trap

The trap here is that candidates confuse the 'Refresh Interval' setting in dashboard panel edit mode with scheduling a search or adjusting the time range, assuming any periodic behavior must involve a scheduled search or a time-based command.

How to eliminate wrong answers

Option A is wrong because the | delay command is not a valid Splunk SPL command; it does not exist and would cause a search error. Option C is wrong because scheduling a search to run every 60 seconds applies to saved searches and alerts, not to dashboard panel auto-refresh; dashboard panels use the Refresh Interval setting, not search scheduling. Option D is wrong because setting the Time Range to 'Last 60 seconds' only controls the time window of data retrieved, not the frequency at which the panel refreshes; the panel would still only refresh when manually triggered or if a separate refresh interval is configured.

Full explanation →
49
MCQmedium

A dashboard designer adds a radio button input to filter by department. When a user selects a department, the panel does not update. What is the most likely cause?

A.The radio button input is not configured with a default value
B.The token name in the search does not match the input's token name
C.The search string does not include a token referencing the input
D.The input's label field is empty
AnswerC

Without a token reference, changing the input has no effect on the search.

Why this answer

Option C is correct because the search must include a token reference like $department$ to use the input value. Option A is wrong because the radio button may or may not require changes to XML; the core issue is token usage. Option B is wrong because token name mismatch is a possible issue, but a missing token reference is more fundamental.

Option D is wrong because the input label has no effect on search.

Full explanation →
50
MCQeasy

A Splunk administrator notices that a data model acceleration summary is not updating as expected. The data model is accelerated with a summary range of 30 days. What is the most likely cause of this issue?

A.The data model is based on a time range older than the summary range.
B.The summary index is not writable due to insufficient disk space.
C.The data model includes calculated fields that are not search-time extractable.
D.The data model acceleration is configured to run only on real-time searches.
AnswerB

Insufficient disk space prevents summary updates, stopping acceleration.

Why this answer

Option B is correct because data model acceleration relies on a summary index to store pre-computed results. If the disk hosting that summary index is full, the acceleration process cannot write new data, causing the summary to stop updating. Splunk will log errors related to disk space, and the acceleration status will show as stalled or incomplete.

Exam trap

The trap here is that candidates often assume the issue is with the data model definition or time range, rather than recognizing that summary index disk space is a common operational cause for acceleration failures.

How to eliminate wrong answers

Option A is wrong because a data model accelerated with a 30-day summary range will still update as long as there is new data within that range; an older time range does not prevent updates. Option C is wrong because calculated fields that are not search-time extractable would cause the data model to fail to build or populate, but they do not specifically prevent the summary from updating once built. Option D is wrong because data model acceleration is not configured to run only on real-time searches; it runs on scheduled or on-demand basis and is independent of real-time search settings.

Full explanation →
51
MCQeasy

In Splunk Web, which option allows a user to save a search result as a report that can be added to a dashboard later?

A.Click 'Save As' and select 'Report'.
B.Click 'Save As' and select 'Search'.
C.Click 'Save As' and select 'Alert'.
D.Click 'Save As' and select 'Dashboard Panel'.
AnswerA

This creates a report that can later be added to a dashboard as a panel.

Why this answer

Option A is correct because in Splunk Web, the 'Save As' menu provides a direct option to save a search result as a report. A report is a saved search that can be reused, scheduled, and added to dashboards as a dashboard panel later. This workflow is the standard method for creating a persistent search artifact that can be visualized on a dashboard.

Exam trap

The trap here is that candidates may confuse 'Save As > Report' with 'Save As > Dashboard Panel', but Splunk requires you to save the search as a report first before you can add it to a dashboard, or use the 'Add to Dashboard' button from the search results page.

How to eliminate wrong answers

Option B is wrong because selecting 'Search' under 'Save As' does not exist; the correct terminology is 'Report' for saving a search result. Option C is wrong because 'Alert' is used to trigger actions based on search results meeting certain conditions, not to save a search result as a reusable report for dashboards. Option D is wrong because 'Dashboard Panel' is not a direct save option; you first save a report, then add it to a dashboard as a panel, or you can create a dashboard panel directly from a search using the 'Add to Dashboard' option, but 'Save As' does not offer 'Dashboard Panel'.

Full explanation →
52
MCQmedium

A team has a lookup table 'app_errors.csv' that includes a field 'error_code'. They want to automatically join error descriptions from 'error_codes.csv' on 'error_code' every time they search a sourcetype. What is the best way to achieve this?

A.Set up an automatic lookup in props.conf for the sourcetype
B.Use an eval statement with if() to assign description
C.Configure field aliases to rename 'error_code'
D.Use the lookup command in every search
AnswerA

Automatic lookups run on all events matching the sourcetype.

Why this answer

Option A is correct because an automatic lookup in props.conf allows you to define a lookup that runs automatically on every search for a given sourcetype, without requiring manual invocation. This configuration joins the 'error_code' field from the search results with the 'error_codes.csv' lookup table, appending the description field to every event of that sourcetype. It is the most efficient and consistent method for automatically enriching data at search time.

Exam trap

Splunk often tests the distinction between automatic lookups (configured in props.conf) and manual lookups (using the lookup command), and the trap here is that candidates may choose the manual lookup command because they are familiar with it, overlooking the requirement for automation.

How to eliminate wrong answers

Option B is wrong because using an eval statement with if() would require manually coding conditional logic for each possible error_code, which is impractical for a large or dynamic set of codes and does not leverage the lookup table. Option C is wrong because field aliases only rename fields, they do not perform joins or enrich data with descriptions from another table. Option D is wrong because using the lookup command in every search requires users to remember and type the command each time, which is error-prone and inconsistent, whereas the requirement is for automatic joining on every search of the sourcetype.

Full explanation →
53
Multi-Selectmedium

Which three of the following are valid ways to navigate and interact with data in the Splunk Web interface? (Choose three.)

Select 3 answers
.Using the Search & Reporting app to run search queries and view results
.Creating a new indexer via the Settings menu to store incoming data
.Configuring data inputs through the Settings menu to bring data into Splunk
.Using the Dashboards feature to create visualizations from saved searches
.Editing Splunk configuration files directly from the web interface without command line access
.Installing new Splunk licenses through the Splunk Home page

Why this answer

The Search & Reporting app is the primary interface for running searches and viewing results, making it a valid way to interact with data. Configuring data inputs via the Settings menu is a standard method for bringing data into Splunk. The Dashboards feature allows users to create visualizations from saved searches, which is a core navigation and interaction capability in the Splunk Web interface.

Exam trap

Splunk often tests the distinction between the Splunk Home page and the Settings menu, leading candidates to mistakenly believe that license installation or configuration file editing can be done from the Home page or directly in the web interface.

Full explanation →
54
MCQeasy

Refer to the exhibit. An analyst receives this error when running a tstats search. Which of the following is the most likely cause?

A.The syntax should use 'datamodel' as a separate argument without equals sign.
B.The data model name or dataset is misspelled.
C.The analyst does not have permission to use tstats.
D.The data model is not accelerated.
AnswerB

A non-existent name causes the argument to be invalid.

Why this answer

The error message in the exhibit indicates that the tstats command cannot find the specified data model or dataset. This typically occurs when the name provided in the 'datamodel=' argument does not match any existing accelerated data model or dataset in Splunk. Option B is correct because a misspelling or incorrect casing in the data model name or dataset is the most common cause of this specific error.

Exam trap

Splunk often tests the distinction between data model acceleration errors and data model name resolution errors, and the trap here is that candidates may incorrectly attribute the error to acceleration being disabled when the actual issue is a simple typo in the data model or dataset name.

How to eliminate wrong answers

Option A is wrong because the 'datamodel' argument in tstats is correctly used with an equals sign (e.g., '| tstats count from datamodel=...'), and using it as a separate argument without the equals sign would be syntactically incorrect. Option C is wrong because if the analyst lacked permission to use tstats, the error would typically be a permissions-related message, not a 'data model not found' error. Option D is wrong because tstats can run against non-accelerated data models (though it may be slower), and the error shown is about the data model not being found, not about acceleration status.

Full explanation →
55
MCQmedium

A user wants to view only specific fields in the search results. Which interface element can be used to select which fields to show?

A.Statistics tab
B.Events tab
C.Fields sidebar
D.Patterns tab
AnswerC

You can check/uncheck fields to display.

Why this answer

Option B is correct. The Fields sidebar allows selecting fields to show. Option A shows events but not field selection.

Option C is for statistics. Option D is for patterns.

Full explanation →
56
MCQeasy

After running a search, a user wants to save the search for later use. Which button should they click?

A.Export
B.Share
C.Save As
D.Schedule
AnswerC

Saves the search for later use.

Why this answer

Option C is correct because the 'Save As' button in Splunk allows a user to save a completed search as a report, alert, or dashboard panel for later use. This is the standard method for persisting a search definition without executing it immediately, enabling reuse in the future.

Exam trap

The trap here is that candidates often confuse 'Save As' with 'Export', thinking that exporting results is the same as saving the search logic, but Splunk separates the act of saving the query definition from exporting the result set.

How to eliminate wrong answers

Option A is wrong because 'Export' is used to download search results (e.g., as CSV, JSON, or raw events) to a local file, not to save the search query itself for later execution. Option B is wrong because 'Share' is used to grant access to an existing saved search, report, or dashboard to other users or roles, not to initially save the search. Option D is wrong because 'Schedule' is used to set a time-based trigger for an already saved search to run automatically, not to save the search for the first time.

Full explanation →
57
MCQeasy

When tagging events in Splunk to map them to a data model, which tag is used to associate events with a specific data model dataset?

A.tag::datamodel=<dataset>
B.tag::<datamodel>=<dataset>
C.tag::<datamodel>=<value>
D.tag::<dataset>=<datamodel>
AnswerB

This format correctly maps events to a data model dataset.

Why this answer

Option B is correct because in Splunk, the tag syntax `tag::<datamodel>=<dataset>` is used to map events to a specific dataset within a data model. The tag key is the data model name, and the tag value is the dataset name, which allows Splunk's data model acceleration to correctly categorize events for reporting and pivot use.

Exam trap

The trap here is that candidates often confuse the order of the data model name and dataset name, mistakenly thinking the dataset should be the tag key (as in option D) or that a generic placeholder like 'datamodel' works (as in option A), when Splunk strictly requires the data model name as the tag key and the dataset name as the tag value.

How to eliminate wrong answers

Option A is wrong because `tag::datamodel=<dataset>` uses a literal key 'datamodel' instead of the actual data model name, so it does not associate events with a specific data model. Option C is wrong because `tag::<datamodel>=<value>` uses a generic 'value' rather than the specific dataset name, which would not correctly map events to a dataset within the data model. Option D is wrong because `tag::<dataset>=<datamodel>` reverses the key-value relationship, assigning the dataset as the tag key and the data model as the value, which does not match Splunk's required syntax for data model dataset association.

Full explanation →
58
MCQhard

A dashboard uses tokens for time range selection. The admin wants to ensure that when a user changes the time range picker from 'Last 24 hours' to 'Last 7 days', all panels in the dashboard update accordingly. What is the correct way to define the token in Simple XML?

A.Define a token $range$ in the time range picker's onChange event.
B.Use the default time range tokens $earliest$ and $latest$ without additional definition.
C.Define a custom token $time_range$ and bind the time range picker to it, then reference $time_range$ in each panel's search.
D.Set the token $timePicker$ in the dashboard's init block.
AnswerB

The default tokens are automatically updated by the time range picker.

Why this answer

Option B is correct because Splunk's Simple XML automatically provides the default time range tokens $earliest$ and $latest$ that are updated whenever the time range picker is changed. These tokens are implicitly bound to the dashboard's time picker, so no additional definition or event handler is needed for all panels to reflect the new time range.

Exam trap

Splunk often tests the misconception that custom tokens or explicit event handlers are required to propagate time range changes, when in fact the default $earliest$ and $latest$ tokens are automatically bound to the time picker and update all panels seamlessly.

How to eliminate wrong answers

Option A is wrong because the time range picker does not have an onChange event; tokens are updated automatically by the framework, and defining a token in an onChange event is unnecessary and not a standard Simple XML approach. Option C is wrong because defining a custom token and binding it to the time range picker is redundant; the default $earliest$ and $latest$ tokens already handle the time range propagation, and custom tokens would require manual binding in each panel's search, which is error-prone. Option D is wrong because there is no $timePicker$ token or init block in Simple XML for time range selection; the time range is managed through the default tokens and the dashboard's time picker element, not a custom init block.

Full explanation →
59
MCQhard

You are a Splunk admin for a large enterprise with multiple distributed Splunk components. The security team frequently runs searches that use a large CSV lookup file (500MB) containing threat intelligence indicators. They report that searches are slow and sometimes time out. The lookup file is updated hourly via an automated script. The team currently uses the 'lookup' command in every search. You need to improve performance without sacrificing data freshness. Your environment has a search head cluster and indexer cluster. The lookup file is stored on a shared filesystem accessible to all search heads. Which single approach will best improve search performance while maintaining hourly updates?

A.Configure the lookup as a time-based lookup with a filter condition to only apply to events with matching IP fields, and use automatic lookup to avoid manual command.
B.Increase the search concurrency limit on the search head to allow more parallel lookups.
C.Convert the CSV to a KV Store collection and use the 'lookup' command with the KV Store lookup.
D.Move the CSV file to each indexer and use index-time field lookup.
AnswerA

Time-based lookups and filtering reduce the number of events processed, improving speed.

Why this answer

Option A is correct because configuring the lookup as a time-based lookup with a filter condition reduces the number of events that need to be matched against the 500MB CSV, and using an automatic lookup eliminates the need for the manual 'lookup' command in every search. This approach improves performance by limiting the lookup scope to relevant events (e.g., only those with matching IP fields) while still allowing the hourly script to update the CSV file, maintaining data freshness.

Exam trap

The trap here is that candidates often assume that moving data to indexers (Option D) or using KV Store (Option C) will always improve performance, without considering the overhead of index-time operations or the limitations of KV Store for large, frequently updated datasets.

How to eliminate wrong answers

Option B is wrong because increasing search concurrency does not address the root cause of slow lookups; it only allows more searches to run simultaneously, which can actually degrade performance further by increasing resource contention. Option C is wrong because converting to a KV Store collection would require significant re-engineering and may not support the same hourly update mechanism; KV Store lookups are typically used for smaller, frequently updated datasets and can introduce latency for large files. Option D is wrong because moving the CSV to each indexer for index-time field lookup would require rebuilding the index for every hourly update, which is impractical and would cause significant indexing delays, defeating the purpose of maintaining data freshness.

Full explanation →
60
MCQeasy

An analyst wants to remove duplicate events based on the 'user' field, keeping only the first occurrence. Which command should be used?

A.| sort -user
B.| uniq user
C.| dedup user
D.| fields user
AnswerC

Removes duplicates on user field.

Why this answer

The `dedup` command in Splunk removes duplicate events based on specified fields, keeping only the first occurrence by default. Since the analyst wants to remove duplicates based on the 'user' field and retain the first event, `| dedup user` is the correct command.

Exam trap

Splunk often tests the misconception that `uniq` can deduplicate across all events based on a field, but `uniq` only removes consecutive duplicates and requires the `-field` syntax, making `dedup` the correct choice for non-consecutive deduplication.

How to eliminate wrong answers

Option A is wrong because `| sort -user` sorts events in descending order by the 'user' field but does not remove duplicates. Option B is wrong because `| uniq user` is invalid syntax; `uniq` requires a field name with a hyphen (e.g., `| uniq user`) but it removes consecutive duplicates only, not all duplicates across the result set, and it does not accept a field argument in that form. Option D is wrong because `| fields user` retains only the 'user' field and removes all other fields, but it does not remove duplicate events.

Full explanation →
61
MCQeasy

A user runs a search and sees "No results found". The time range is set to "All time". Data exists in the index "main" and sourcetype "access_combined". Which is the most likely cause?

A.The index is disabled.
B.The search string contains a typo.
C.The user lacks read permissions on the index.
D.The time range is too narrow.
AnswerB

This is the most common cause of no results.

Why this answer

Option B is correct because the most common cause of 'No results found' when data is confirmed to exist in the index and sourcetype is a typo in the search string. Splunk's search engine performs exact string matching against indexed tokens, so even a minor misspelling (e.g., 'acces_combined' instead of 'access_combined') will return zero results. The user has already verified data exists, so the issue is likely in the search syntax itself.

Exam trap

Splunk often tests the misconception that 'No results found' must be due to permissions or index issues, when in reality a simple typo in the search string is the most common and easily overlooked cause.

How to eliminate wrong answers

Option A is wrong because if the index were disabled, the search would typically return an error message like 'Index not found' or 'No data in index', not just 'No results found'. Option C is wrong because if the user lacked read permissions on the index, Splunk would return a permissions-related error (e.g., 'You do not have permission to access this index') rather than silently showing 'No results found'. Option D is wrong because the time range is set to 'All time', which is the widest possible range and cannot be too narrow; a narrow time range would be a specific start/end or relative time like 'Last 15 minutes'.

Full explanation →
62
MCQeasy

This message appears in the Monitoring Console. What does it indicate?

A.The search head is disconnected from the indexer.
B.The indexer is not receiving any data.
C.The license is exhausted.
D.The user does not have permission to search.
AnswerB

Directly matches the error message.

Why this answer

The Monitoring Console message indicates that the indexer is not receiving any data. This typically means that forwarders are not sending data to the indexer, or the indexer's receiving port is not configured or is blocked. In Splunk, the Monitoring Console aggregates health metrics from indexers, search heads, and forwarders; a 'no data received' alert specifically points to a data ingestion failure at the indexer level.

Exam trap

Splunk often tests the distinction between indexer-level data ingestion alerts and search-head connectivity or license warnings, so candidates mistakenly associate a 'no data' message with a license exhaustion or permission error instead of a pure data flow issue.

How to eliminate wrong answers

Option A is wrong because a disconnected search head would generate errors related to search distribution or peer connectivity, not a 'no data received' message on the indexer. Option C is wrong because an exhausted license would trigger a license violation warning, not a data ingestion alert; the indexer would still receive data but would block or warn about license usage. Option D is wrong because a permission issue would result in a search-time authorization error, not an indexer-level data receipt message; the Monitoring Console's data ingestion status is independent of user permissions.

Full explanation →
63
MCQeasy

An admin runs '| datamodel App_State' and receives the error 'No data model named 'App_State''. Which of the following is the most likely cause?

A.The data model exists in a different app whose permissions do not allow the admin to see it.
B.The data model has not been saved.
C.The data model exists but is not accelerated.
D.The data model name is misspelled.
AnswerA

Permissions limit visibility of data models from other apps.

Why this answer

The error 'No data model named 'App_State'' occurs when the datamodel command cannot locate the specified data model. The most likely cause is that the data model exists in a different app context, and the admin's role permissions do not grant read access to that app, making the data model invisible to the search. In Splunk, data models are scoped to specific apps, and cross-app visibility is controlled by app-level permissions.

Exam trap

Splunk often tests the misconception that a data model must be accelerated to be queried, but acceleration only affects search performance, not the ability to list or inspect the data model's schema.

How to eliminate wrong answers

Option B is wrong because if the data model had not been saved, it would not exist at all, and the error would still occur, but the question asks for the 'most likely' cause given the admin's perspective; unsaved data models are not a common scenario for a production admin. Option C is wrong because acceleration is unrelated to the existence of a data model; a data model can exist without being accelerated, and the command '| datamodel App_State' would still work (returning the schema) even if unaccelerated. Option D is wrong because while a misspelling could cause the same error, the question implies the admin believes the name is correct, and the most likely cause in a multi-app environment is permission restrictions, not a typo.

Full explanation →
64
MCQhard

An administrator notices that a data model with acceleration is not returning results for a specific time range. The search uses `| datamodel` command. The summary range is set to 30 days. What is the most likely cause?

A.The acceleration has overwritten the original raw data.
B.The `| datamodel` command requires the `summariesonly=t` argument to use acceleration.
C.The search time range exceeds the summary range of the acceleration.
D.The data model has a constraint that excludes the specific time range.
AnswerC

If the time range is beyond the summary range, acceleration may not cover that period, causing fallback to raw data which might not be indexed.

Why this answer

When a data model is accelerated with a summary range of 30 days, the acceleration only precomputes and stores aggregated results for events within that 30-day window. If the search time range exceeds 30 days, the `| datamodel` command cannot use the accelerated summaries for the older data, and it must fall back to searching the raw data. However, if the acceleration is configured to only use summaries (e.g., with `summariesonly=t`), or if the raw data is not available, the search will return no results for the out-of-range period.

The most likely cause given the scenario is that the search time range extends beyond the 30-day summary range, making the acceleration ineffective for that portion of the search.

Exam trap

Splunk often tests the misconception that acceleration always works for any time range, but the trap here is that candidates overlook the summary range limitation and assume acceleration covers all data regardless of the search window.

How to eliminate wrong answers

Option A is wrong because acceleration does not overwrite or delete raw data; it creates separate summary indexes that are stored alongside the original data. Option B is wrong because the `| datamodel` command does not require `summariesonly=t` to use acceleration; that argument forces the search to use only accelerated summaries, but acceleration is used by default when available without it. Option D is wrong because a data model constraint filters events at index time or search time, but it would not cause a time-range-specific failure; the constraint applies uniformly across all time ranges.

Full explanation →
65
Multi-Selecthard

A Splunk administrator is troubleshooting a time-based lookup that is supposed to match events to a lookup table that changes over time. The lookup is defined with time_field 'start_time' and time_format '%Y-%m-%d %H:%M:%S'. Which THREE conditions must be met for the time-based lookup to correctly match an event to a single row in the lookup table? (Choose three.)

Select 3 answers
A.The lookup table must have exactly one row per unique time value
B.The lookup must be defined as an automatic lookup in props.conf
C.The lookup definition must specify the time format used in the time_field column
D.The event's timestamp (or a specified time field) must fall between the start_time and the end_time of a row
E.The event must match at most one row in the lookup table for the given time range
AnswersC, D, E

The time_format must match the format in the lookup file for correct parsing.

Why this answer

Option C is correct because the lookup definition must specify the time format used in the time_field column so that Splunk can correctly parse the time values in the lookup table. Without this format specification, Splunk cannot interpret the timestamps and the time-based matching will fail.

Exam trap

The trap here is that candidates often think a time-based lookup requires exactly one row per time value (Option A) or that it must be defined as an automatic lookup (Option B), but the core requirements are the time format specification, the time range containment, and the single-row match constraint.

Full explanation →
66
MCQmedium

An organization wants to define a data model that represents transaction-level data from multiple source types, including web logs and application logs. They need to ensure that the data model is scalable and easy to maintain. Which best practice should the admin follow when designing this data model?

A.Create separate data models for each sourcetype to avoid complexity.
B.Avoid using constraints to ensure all events are included in the data model.
C.Include all possible fields that might ever be needed in the data model to avoid future modifications.
D.Use child objects under a root event to represent different sourcetypes, and assign appropriate constraints.
AnswerD

Child objects enhance modularity and reuse.

Why this answer

Option D is correct because using child objects under a root event allows the admin to model transaction-level data from multiple sourcetypes (e.g., web logs, application logs) within a single data model, promoting scalability and maintainability. By assigning appropriate constraints to each child object, the admin ensures that only relevant events are included, while the root event provides a common structure for transaction analysis. This approach follows Splunk best practices for data model design, enabling efficient searches and reducing duplication.

Exam trap

The trap here is that candidates often think separate data models per sourcetype (Option A) are simpler, but Splunk tests the understanding that a single data model with child objects and constraints is the scalable, maintainable best practice for multi-sourcetype transaction data.

How to eliminate wrong answers

Option A is wrong because creating separate data models for each sourcetype increases complexity and maintenance overhead, making it harder to perform cross-sourcetype transaction analysis. Option B is wrong because avoiding constraints can lead to irrelevant events being included, degrading search performance and data model accuracy. Option C is wrong because including all possible fields upfront bloats the data model, reduces search efficiency, and contradicts the principle of only including fields necessary for the defined use case.

Full explanation →
67
Drag & Dropmedium

Drag and drop the steps to add a new data input using Splunk Web (e.g., monitor a log file) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order

Why this order

Adding a data input involves selecting the type, specifying the source, and configuring metadata.

Full explanation →
68
MCQeasy

A new user accidentally closed the search bar while in the Search & Reporting app and can no longer see it. What is the most direct way to restore the search bar?

A.Click on the 'Search & Reporting' app link in the top menu bar.
B.Refresh the browser page.
C.Go to Settings > Search bar and re-enable it.
D.Restart the Splunk server.
AnswerA

Correct: This navigates to the app and resets the interface.

Why this answer

Option B is correct because clicking the Search & Reporting app link in the Apps menu or on the top bar navigates to the app and resets the interface, restoring the search bar. Option A is incorrect because refreshing the browser may not restore the UI component if it was closed via a toggle. Option C is incorrect because restarting Splunk is unnecessary and not a direct fix.

Option D is incorrect because the search bar does not have a separate configuration toggle.

Full explanation →
69
MCQeasy

A user has a lookup file containing employee email addresses and department names. They want to add the department field to search results containing the employee's email. Which command should they use?

A.inputlookup employee_department.csv
B.lookup employee_department.csv email OUTPUT department
C.eval department=employee_department(email)
D.outputlookup employee_department.csv
AnswerB

Lookup joins on the email field and outputs the department field into search results.

Why this answer

The `lookup` command is designed to enrich search results by matching a field in the events (e.g., email) against a lookup table (e.g., employee_department.csv) and outputting additional fields (e.g., department). Option B correctly uses the syntax `lookup employee_department.csv email OUTPUT department`, which performs a field-based lookup and appends the department field to matching events.

Exam trap

The trap here is that candidates confuse `inputlookup` (which reads the file as events) with `lookup` (which enriches existing events), leading them to choose option A when they need field enrichment.

How to eliminate wrong answers

Option A is wrong because `inputlookup` loads the entire lookup file as search results, not as a field enrichment tool; it would return all rows from the CSV instead of adding the department field to existing events. Option C is wrong because `eval` cannot perform a lookup; it is used for field calculations and transformations, not for retrieving data from external files. Option D is wrong because `outputlookup` writes search results to a lookup file, which is the opposite of what is needed—it does not add fields to events.

Full explanation →
70
MCQhard

An organization uses a KV Store lookup to maintain a list of known malicious IPs. The lookup is updated every 5 minutes via a script. Analysts complain that their searches sometimes miss recent additions. What is the most likely cause?

A.The lookup is configured as time-based and is out of range
B.The IP addresses are case-sensitive and messy
C.The search does not include the _raw field
D.The KV Store lookup is cached and not refreshed between searches
AnswerD

Caching can cause latency; disable caching or force refresh.

Why this answer

Option B is correct because by default, KV Store lookups are cached and only reloaded when the cache expires or at search time. If the cache is stale, recent updates may not be seen. Option A is wrong because field filtering doesn't affect lookup content.

Option C is wrong because lookup is case-sensitive by default. Option D is wrong because time-based lookups are not for KV Store.

Full explanation →
71
Multi-Selectmedium

Which of the following are true about creating and managing dashboards in Splunk? (Choose all that apply. There are four correct answers.)

Select 4 answers
.A dashboard can include panels based on reports, inline searches, or both.
.A dashboard panel can display data using visualizations such as charts, tables, and maps.
.A dashboard can be created from scratch using the Dashboard Editor without any existing search.
.When editing a dashboard, you can set permissions to control which users can view or edit it.
.All dashboards must be based on a saved report before they can be created.
.Dashboards can only contain up to five panels per dashboard.

Why this answer

All four selected options are correct because Splunk dashboards are flexible: they can combine panels from saved reports and inline searches, support multiple visualization types (charts, tables, maps), can be built from scratch using the Dashboard Editor without requiring a pre-existing search, and allow permission settings to control user access and editing rights. These features are core to Splunk's dashboard functionality as documented in the Splunk Dashboard documentation.

Exam trap

The trap here is that candidates often assume dashboards require pre-existing saved reports or have arbitrary panel limits, but Splunk explicitly supports inline searches and has no fixed panel count restriction.

Full explanation →
72
MCQeasy

A user wants to see the top 5 most common values of the 'action' field in the web access logs. Which command should be used?

A.rare
B.fields
C.sort
D.top
AnswerD

top returns most common values.

Why this answer

The `top` command is designed to find the most frequent values of a field. By default, it returns the top 10 results, but you can specify `limit=5` to get the top 5 most common values of the 'action' field in web access logs.

Exam trap

Splunk often tests the distinction between `top` and `sort`; candidates mistakenly think `sort` can rank by frequency, but `sort` only reorders existing results without performing any count or aggregation.

How to eliminate wrong answers

Option A is wrong because `rare` finds the least common values, not the most common. Option B is wrong because `fields` is used to keep or remove fields from search results, not to count or rank field values. Option C is wrong because `sort` orders results by a field value but does not aggregate or count occurrences to identify the most common values.

Full explanation →
73
MCQeasy

An analyst runs a search and needs to view only events where the 'status' field has a value of 'failed'. Which command should be used?

A.table status
B.search status=failed
C.eval status = "failed"
D.where status = "failed"
AnswerD

where filters events based on field values.

Why this answer

Option D is correct because the `where` command in Splunk allows you to filter events based on a field value using a comparison expression. In this case, `where status = "failed"` evaluates each event and retains only those where the `status` field exactly matches the string "failed". This is the appropriate command when you need to filter results after the initial search has already been run, or when you need to use comparison operators that are not available in the `search` command.

Exam trap

Splunk often tests the distinction between the `search` command (which is implicit at the start of a search and uses key=value syntax) and the `where` command (which is used later in the pipeline and requires an expression with quotes around string values), causing candidates to mistakenly choose `search status=failed` when the context requires filtering after initial search processing.

How to eliminate wrong answers

Option A is wrong because `table status` only returns a table with the `status` field values, but does not filter events to show only those with a value of 'failed'. Option B is wrong because `search status=failed` is a valid search command but it is used at the beginning of a search pipeline to filter events before any other processing; the question implies the analyst is already running a search and needs to view only events where status is 'failed', which is better accomplished with `where` to avoid re-running the search. Option C is wrong because `eval status = "failed"` creates or overwrites the `status` field with the value "failed" for every event, rather than filtering events based on an existing field value.

Full explanation →
74
MCQmedium

An analyst notices that searches take long to complete. They want to understand how many events are indexed per second. Which tab in the Monitoring Console provides this information?

A.Indexing Performance
B.License Usage
C.Search Performance
D.Forwarder Management
AnswerA

Shows events indexed per second.

Why this answer

The Monitoring Console's 'Indexing Performance' tab provides real-time metrics on indexing throughput, including events per second (EPS) and indexing latency. This directly answers the analyst's need to understand how many events are indexed per second, as it displays the rate at which data is being processed and written to indexes.

Exam trap

Splunk often tests the distinction between 'indexing performance' (data input rate) and 'search performance' (query execution speed), so candidates mistakenly choose Search Performance when the question is about data ingestion throughput.

How to eliminate wrong answers

Option B (License Usage) is wrong because it shows license volume and quota usage, not real-time indexing throughput like events per second. Option C (Search Performance) is wrong because it focuses on search execution metrics (e.g., job duration, scan rates) rather than data ingestion rates. Option D (Forwarder Management) is wrong because it monitors forwarder health and connectivity, not the indexing rate on the indexer tier.

Full explanation →
75
MCQmedium

An analyst needs to see the top 5 error codes by count. Which visualization is most appropriate?

A.Pie chart
B.Line chart
C.Bar chart
D.Single Value
AnswerC

Bar charts display categories side-by-side, making comparisons easy.

Why this answer

A bar chart is the most appropriate visualization for comparing the count of distinct error codes because it allows easy comparison of categorical data (error codes) against a numeric value (count). In Splunk, the `top` command or `stats count by error_code` produces results that are best visualized with a bar chart to show the relative frequency of each error code, and the chart can be limited to the top 5 by setting the limit in the search or chart properties.

Exam trap

The trap here is that candidates often choose a pie chart because they think of 'top 5' as parts of a whole, but Splunk's exam emphasizes that bar charts are better for comparing counts across categories, especially when the categories are not mutually exclusive or when precise comparison is needed.

How to eliminate wrong answers

Option A is wrong because a pie chart is used to show proportions of a whole, but when comparing the top 5 error codes by count, a bar chart provides a clearer comparison of exact counts without the distortion of angles or areas, especially when counts are similar. Option B is wrong because a line chart is designed to show trends over a continuous time series, not discrete categorical comparisons like error codes; using it here would misrepresent the data as having a sequential order. Option D is wrong because a Single Value visualization displays only one aggregate metric (e.g., total count), not the top 5 individual error codes and their counts, so it cannot show the required breakdown.

Full explanation →

Page 1 of 7

Page 2

All pages

1234567

Practice SPLK-1002 by domain

Target a specific domain to shore up weak areas.

Splunk Basics and Interface NavigationBasic Searching and Transforming CommandsUsing Fields and LookupsCreating Reports, Dashboards and VisualizationsData Models and Best Practices
See all domains with question counts →